tender-scraper-xiaobai

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward public tender-announcement scraper with dependency hygiene issues but no evidence of hidden access or harmful behavior.

Install only from a trusted package index and consider pinning requests to a current vetted version before use. Expect the skill to make outbound requests to ygcg.nbcqjy.org and return public procurement notice data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests beautifulsoup4
Confidence: 95% confidence
Finding: requests

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests beautifulsoup4
Confidence: 94% confidence
Finding: beautifulsoup4

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: requests

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal